next-13.0.1.tgz: 27 vulnerabilities (highest severity is: 9.3)

[mend-bolt-for-github]

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (next version)	Remediation Possible**
CVE-2026-64645	Critical	9.3	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11	❌
CVE-2025-29927	Critical	9.1	next-13.0.1.tgz	Direct	13.5.9	❌
CVE-2026-64641	High	7.5	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11	❌
CVE-2026-45623	High	7.5	postcss-8.4.14.tgz	Transitive	N/A*	❌
CVE-2026-44573	High	7.5	next-13.0.1.tgz	Direct	15.5.16	❌
CVE-2024-51479	High	7.5	next-13.0.1.tgz	Direct	13.5.8	❌
CVE-2023-46298	High	7.5	next-13.0.1.tgz	Direct	next - 13.4.20-canary.13	❌
CVE-2026-64648	High	7.1	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21	❌
CVE-2026-29057	Medium	6.5	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13	❌
CVE-2025-57822	Medium	6.5	next-13.0.1.tgz	Direct	14.2.32	❌
CVE-2025-57752	Medium	6.2	next-13.0.1.tgz	Direct	14.2.31	❌
CVE-2026-44580	Medium	6.1	next-13.0.1.tgz	Direct	next - 15.5.16,next - 16.2.5	❌
CVE-2026-41305	Medium	6.1	postcss-8.4.14.tgz	Transitive	N/A*	❌
CVE-2026-44577	Medium	5.9	next-13.0.1.tgz	Direct	next - 15.5.16,next - 16.2.5	❌
CVE-2025-59471	Medium	5.9	next-13.0.1.tgz	Direct	next - 15.5.10,next - 16.1.5	❌
CVE-2024-47831	Medium	5.9	next-13.0.1.tgz	Direct	13.5.8	❌
CVE-2026-64646	Medium	5.3	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11	❌
CVE-2026-64643	Medium	5.3	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11	❌
CVE-2026-27980	Medium	5.3	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13	❌
CVE-2024-56332	Medium	5.3	next-13.0.1.tgz	Direct	13.5.7-canary.9	❌
CVE-2023-44270	Medium	5.3	postcss-8.4.14.tgz	Transitive	13.5.4-canary.8	❌
CVE-2026-64647	Medium	4.8	next-13.0.1.tgz	Direct	https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21	❌
CVE-2025-48068	Medium	4.7	next-13.0.1.tgz	Direct	14.2.30	❌
CVE-2025-55173	Medium	4.3	next-13.0.1.tgz	Direct	14.2.31	❌
CVE-2024-55565	Medium	4.3	nanoid-3.3.4.tgz	Transitive	13.0.2-canary.0	❌
CVE-2026-44572	Low	3.7	next-13.0.1.tgz	Direct	next - 16.2.5,next - 15.5.16	❌
CVE-2025-32421	Low	3.7	next-13.0.1.tgz	Direct	14.2.24	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (24 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2026-64645

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a
rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

Publish Date: 2026-07-27

URL: CVE-2026-64645

CVSS 3 Score Details (9.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p9j2-gv94-2wf4

Release Date: 2026-07-23

Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11

Step up your Open Source Security Game with Mend here

CVE-2025-29927

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-03-21

URL: CVE-2025-29927

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f82v-jwr5-mffw

Release Date: 2025-03-21

Fix Resolution: 13.5.9

Step up your Open Source Security Game with Mend here

CVE-2026-64641

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

Publish Date: 2026-07-27

URL: CVE-2026-64641

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m99w-x7hq-7vfj

Release Date: 2026-07-23

Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11

Step up your Open Source Security Game with Mend here

CVE-2026-45623

Vulnerable Library - postcss-8.4.14.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-13.0.1.tgz (Root Library)
  • ❌ postcss-8.4.14.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

Publish Date: 2026-07-27

URL: CVE-2026-45623

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-23

Fix Resolution: postcss - 8.5.12,https://github.com/postcss/postcss.git - 8.5.12

Step up your Open Source Security Game with Mend here

CVE-2026-44573

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data//.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

Publish Date: 2026-05-13

URL: CVE-2026-44573

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-36qx-fr4f-26g5

Release Date: 2026-05-05

Fix Resolution: 15.5.16

Step up your Open Source Security Game with Mend here

CVE-2024-51479

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] "https://example.com/" * [Affected] "https://example.com/foo" * [Not affected] "https://example.com/foo/bar". This issue is patched in Next.js "14.2.15" and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.

Publish Date: 2024-12-17

URL: CVE-2024-51479

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7gfc-8cq8-jh5f

Release Date: 2024-12-17

Fix Resolution: 13.5.8

Step up your Open Source Security Game with Mend here

CVE-2023-46298

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

Publish Date: 2023-10-22

URL: CVE-2023-46298

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c59h-r6p8-q9wc

Release Date: 2023-10-22

Fix Resolution: next - 13.4.20-canary.13

Step up your Open Source Security Game with Mend here

CVE-2026-64648

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.

Publish Date: 2026-07-27

URL: CVE-2026-64648

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-68g3-v927-f742

Release Date: 2026-07-23

Fix Resolution: https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21

Step up your Open Source Security Game with Mend here

CVE-2026-29057

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Summary When Next.js rewrites proxy traffic to an external backend, a crafted "DELETE"/"OPTIONS" request using "Transfer-Encoding: chunked" could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. Impact An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. Patches The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so "content-length: 0" is added only when both "content-length" and "transfer-encoding" are absent, and "transfer-encoding" is no longer removed in that code path. Workarounds If upgrade is not immediately possible: - Block chunked "DELETE"/"OPTIONS" requests on rewritten routes at your edge/proxy. - Enforce authentication/authorization on backend routes per our "security guidance" (https://nextjs.org/docs/app/guides/data-security).

Publish Date: 2026-03-18

URL: CVE-2026-29057

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-18

Fix Resolution: https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13

Step up your Open Source Security Game with Mend here

CVE-2025-57822

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-08-29

URL: CVE-2025-57822

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4342-x723-ch2f

Release Date: 2025-08-29

Fix Resolution: 14.2.32

Step up your Open Source Security Game with Mend here

CVE-2025-57752

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

Publish Date: 2025-08-29

URL: CVE-2025-57752

CVSS 3 Score Details (6.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g5qg-72qw-gw5v

Release Date: 2025-08-29

Fix Resolution: 14.2.31

Step up your Open Source Security Game with Mend here

CVE-2026-44580

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.

Publish Date: 2026-05-13

URL: CVE-2026-44580

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gx5p-jg67-6x7h

Release Date: 2026-05-11

Fix Resolution: next - 15.5.16,next - 16.2.5

Step up your Open Source Security Game with Mend here

CVE-2026-41305

Vulnerable Library - postcss-8.4.14.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-13.0.1.tgz (Root Library)
  • ❌ postcss-8.4.14.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.

Publish Date: 2026-04-24

URL: CVE-2026-41305

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qx2v-qp2m-jg93

Release Date: 2026-04-24

Fix Resolution: postcss - 8.5.10,https://github.com/postcss/postcss.git - 8.5.10

Step up your Open Source Security Game with Mend here

CVE-2026-44577

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

Publish Date: 2026-05-13

URL: CVE-2026-44577

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h64f-5h5j-jqjh

Release Date: 2026-05-11

Fix Resolution: next - 15.5.16,next - 16.2.5

Step up your Open Source Security Game with Mend here

CVE-2025-59471

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists in self-hosted Next.js applications that have "remotePatterns" configured for the Image Optimizer. The image optimization endpoint ("/_next/image") loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that "remotePatterns" is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

Publish Date: 2026-01-26

URL: CVE-2025-59471

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9g9p-9gw9-jx7f

Release Date: 2026-01-26

Fix Resolution: next - 15.5.10,next - 16.1.5

Step up your Open Source Security Game with Mend here

CVE-2024-47831

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the "next.config.js" file that is configured with "images.unoptimized" set to "true" or "images.loader" set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js "14.2.7". As a workaround, ensure that the "next.config.js" file has either "images.unoptimized", "images.loader" or "images.loaderFile" assigned.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-10-14

URL: CVE-2024-47831

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g77x-44xx-532m

Release Date: 2024-10-14

Fix Resolution: 13.5.8

Step up your Open Source Security Game with Mend here

CVE-2026-64646

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.

Publish Date: 2026-07-27

URL: CVE-2026-64646

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4c39-4ccg-62r3

Release Date: 2026-07-23

Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11

Step up your Open Source Security Game with Mend here

CVE-2026-64643

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.

Publish Date: 2026-07-27

URL: CVE-2026-64643

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-955p-x3mx-jcvp

Release Date: 2026-07-23

Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11

Step up your Open Source Security Game with Mend here

CVE-2026-27980

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache ("/_next/image") did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with "images.maximumDiskCacheSize", including eviction of least-recently-used entries when the limit is exceeded. Setting "maximumDiskCacheSize: 0" disables disk caching. If upgrading is not immediately possible, periodically clean ".next/cache/images" and/or reduce variant cardinality (e.g., tighten values for "images.localPatterns", "images.remotePatterns", and "images.qualities").

Publish Date: 2026-03-18

URL: CVE-2026-27980

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-18

Fix Resolution: https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13

Step up your Open Source Security Game with Mend here

CVE-2024-56332

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid "Content-Length" header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recommend that users upgrade to a safe version. There are no official workarounds.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-01-03

URL: CVE-2024-56332

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7m27-7ghc-44w9

Release Date: 2025-01-03

Fix Resolution: 13.5.7-canary.9

Step up your Open Source Security Game with Mend here

CVE-2023-44270

Vulnerable Library - postcss-8.4.14.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-13.0.1.tgz (Root Library)
  • ❌ postcss-8.4.14.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29

URL: CVE-2023-44270

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7fh5-64p2-3v2j

Release Date: 2023-09-29

Fix Resolution (postcss): 8.4.31

Direct dependency fix Resolution (next): 13.5.4-canary.8

Step up your Open Source Security Game with Mend here

CVE-2026-64647

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.

Publish Date: 2026-07-27

URL: CVE-2026-64647

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4633-3j49-mh5q

Release Date: 2026-07-23

Fix Resolution: https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21

Step up your Open Source Security Game with Mend here

CVE-2025-48068

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-05-30

URL: CVE-2025-48068

CVSS 3 Score Details (4.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-05-30

Fix Resolution: 14.2.30

Step up your Open Source Security Game with Mend here

CVE-2025-55173

Vulnerable Library - next-13.0.1.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-13.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-13.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.

Publish Date: 2025-08-29

URL: CVE-2025-55173

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xv57-4mr9-wg8v

Release Date: 2025-08-29

Fix Resolution: 14.2.31

Step up your Open Source Security Game with Mend here